T1110.002 — Password Cracking

Tactic: Credential Access · Platforms: Identity Provider, Linux, macOS, Network Devices, Office Suite, Windows

Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. OS Credential Dumping can be used to obtain password hashes, this may only get an adversary so far when Pass the Hash is not…

Sub-technique of Brute Force (T1110).

Sigma detection rules (5)

T1110.002 Brute Force: Password Cracking

title: "T1110.002 Brute Force: Password Cracking"
id: db8d6f98-188a-45a3-9ab8-756ce72aff76
description: 'Detects execution of offline password/hash-cracking tools (hashcat, John the Ripper, ophcrack) used to recover plaintext passwords from previously obtained hashes (the previous version also matched mimikatz.exe, which performs live credential dumping/pass-the-hash, T1003/T1550 -- a different technique than offline password cracking). Tune using: HashToolName, FilePathIndicators, ExecutionContext.'
references:
  - https://attack.mitre.org/techniques/T1110/002
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\hashcat.exe'
      - '\hashcat64.exe'
      - '\john.exe'
      - '\johnny.exe'
      - '\ophcrack.exe'

  condition: selection

falsepositives:
  - Authorized penetration-testing or password-audit tooling run by security teams -- allowlist by host/user during scheduled assessments.

level: critical

T1110.002 Brute Force: Password Cracking

title: "T1110.002 Brute Force: Password Cracking"
id: e52bc75b-31cc-4124-a737-235109281869
description: 'Post-Credential Dump Password Cracking Detection via Suspicious File Access and Hash Analysis Tools. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ShadowAccessPattern, CrackingBinaryPath, CPUUsageThreshold.'
references:
  - https://attack.mitre.org/techniques/T1110/002
author: Shahrukh Khan
date: 2026-02-21
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/john'
      - '/hashcat'
  selection_shadow:
    type: PATH
    name: '/etc/shadow'
    nametype: NORMAL

  condition: 1 of selection*

falsepositives:
  - Authorized password-audit exercises by security teams legitimately run john/hashcat against exported shadow copies; scope to hosts/accounts outside the approved audit schedule.

level: high

T1110.002 Brute Force: Password Cracking

title: "T1110.002 Brute Force: Password Cracking"
id: 63fcb07e-7b71-464c-80d6-d93892f1eaf0
description: 'Post-Credential Dump Password Cracking Detection via Suspicious File Access and Hash Analysis Tools. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UnsignedBinaryPath, UserPrivilegeLevel.'
references:
  - https://attack.mitre.org/techniques/T1110/002
author: Shahrukh Khan
date: 2026-01-19
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/hashcat'
      - '/john'

  condition: selection

falsepositives:
  - Security teams legitimately running authorized password-cracking audits with the same tools.

level: high

T1110.002 Brute Force: Password Cracking

title: "T1110.002 Brute Force: Password Cracking"
id: bce83402-f154-4704-af2d-7e470936c650
description: 'Post-Credential Dump Password Cracking Detection via Suspicious File Access and Hash Analysis Tools. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: PostDumpTimeWindow, LoginLocationRisk.'
references:
  - https://attack.mitre.org/techniques/T1110/002
author: Shahrukh Khan
date: 2026-06-13
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.002

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType: '0'
  newlocation:
    RiskState: 'atRisk'

  condition: selection and newlocation

falsepositives:
  - Legitimate travel or new VPN egress points flagged as risky by Identity Protection without any credential cracking activity.

level: high

T1110.002 Brute Force: Password Cracking

title: "T1110.002 Brute Force: Password Cracking"
id: 4df20086-ed64-48b8-bfa9-0e3247867436
description: 'Post-Credential Dump Password Cracking Detection via Suspicious File Access and Hash Analysis Tools. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: LogonTimeCorrelation, SourceDeviceTag.'
references:
  - https://attack.mitre.org/techniques/T1110/002
author: Shahrukh Khan
date: 2026-01-01
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.002

logsource:
  product: networkdevice
  service: syslog

detection:
  selection_failed:
    Message|contains: '%SEC_LOGIN-4-LOGIN_FAILED'
  condition: selection_failed

falsepositives:
  - A legitimate administrator repeatedly mistyping a password after a recent credential rotation produces the same syslog fragment.

level: medium

Related sub-techniques

Explore